diff options
| author | Rafael Zalamena <rzalamena@opensourcerouting.org> | 2022-12-07 15:49:26 +0100 |
|---|---|---|
| committer | Rafael Zalamena <rzalamena@opensourcerouting.org> | 2022-12-07 15:49:26 +0100 |
| commit | 1dd422a22bbb5893dd0872bf5aeb6ec4dab6f98f (patch) | |
| tree | c7728c991309fd7e91c587fb64ef151a4e5cbc45 /pimd/pim_msdp_packet.c | |
| parent | pimd: fix MSDP crash on unexpected TLV sizes (diff) | |
| download | frr-1dd422a22bbb5893dd0872bf5aeb6ec4dab6f98f.tar.xz frr-1dd422a22bbb5893dd0872bf5aeb6ec4dab6f98f.zip | |
pimd: fix MSDP packet debug crashes
Add some safe guards to avoid crashes and alert us about programming
errors in packet build.
Signed-off-by: Rafael Zalamena <rzalamena@opensourcerouting.org>
Diffstat (limited to 'pimd/pim_msdp_packet.c')
| -rw-r--r-- | pimd/pim_msdp_packet.c | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/pimd/pim_msdp_packet.c b/pimd/pim_msdp_packet.c index 9f0cba03c..5230f6a33 100644 --- a/pimd/pim_msdp_packet.c +++ b/pimd/pim_msdp_packet.c @@ -83,10 +83,18 @@ static void pim_msdp_pkt_sa_dump_one(struct stream *s) static void pim_msdp_pkt_sa_dump(struct stream *s) { + const size_t header_length = PIM_MSDP_SA_X_SIZE - PIM_MSDP_HEADER_SIZE; + size_t payload_length; int entry_cnt; int i; struct in_addr rp; /* Last RP address associated with this SA */ + if (header_length > STREAM_READABLE(s)) { + zlog_err("BUG MSDP SA bad header (readable %zu expected %zu)", + STREAM_READABLE(s), header_length); + return; + } + entry_cnt = stream_getc(s); rp.s_addr = stream_get_ipv4(s); @@ -96,6 +104,13 @@ static void pim_msdp_pkt_sa_dump(struct stream *s) zlog_debug(" entry_cnt %d rp %s", entry_cnt, rp_str); } + payload_length = (size_t)entry_cnt * PIM_MSDP_SA_ONE_ENTRY_SIZE; + if (payload_length > STREAM_READABLE(s)) { + zlog_err("BUG MSDP SA bad length (readable %zu expected %zu)", + STREAM_READABLE(s), payload_length); + return; + } + /* dump SAs */ for (i = 0; i < entry_cnt; ++i) { pim_msdp_pkt_sa_dump_one(s); @@ -116,6 +131,11 @@ static void pim_msdp_pkt_dump(struct pim_msdp_peer *mp, int type, int len, return; } + if (len < PIM_MSDP_HEADER_SIZE) { + zlog_err("invalid MSDP header length"); + return; + } + switch (type) { case PIM_MSDP_V4_SOURCE_ACTIVE: pim_msdp_pkt_sa_dump(s); |